feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

scripts/iam/zitadel-provision.py

@@ -362,10 +362,14 @@ def phase_apply(_args: argparse.Namespace) -> int:
 SECRET_MAP = {
     "grafana": [("grafana-oidc-secrets.enc.yaml", "grafana-oidc",
                  "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
+    "homarr": [("homarr-auth-oidc.enc.yaml", "homarr-oidc",
+                "client-id", "id"),
+               ("homarr-auth-oidc.enc.yaml", "homarr-oidc",
+                "client-secret", "secret")],
     "minio": [("minio-secrets.enc.yaml", "minio-oidc",
                "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
-    "paperless-ai-agent": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
-                            "LLM_AUTH_CLIENT_SECRET", "secret")],
+    "paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
+                   "LLM_AUTH_CLIENT_SECRET", "secret")],
 }
 
 # Clients whose client_id lives in a plain (unencrypted) manifest. They need the
@@ -375,18 +379,14 @@ CLIENT_ID_MAP = {
     "grafana": ("k8s/infra/logging/grafana-values.yaml",
                 r"(?m)^(\s*client_id:\s*)\S+\s*$", r"\g<1>{value}"),
     "minio": ("k8s/infra/minio/minio-tenant.yaml",
-              r"(?m)^(\s*value:\s*)\"minio\"\s*$", r'\g<1>"{value}"'),
-    "paperless-ai-agent": ("k8s/apps/paperless/paperless-ai.yaml",
-                           r"client_id=paperless-ai-agent", "client_id={value}"),
+              r'(?m)^(\s*value:\s*)"(?:minio|\d+)"\s*$', r'\g<1>"{value}"'),
+    "paperless": ("k8s/apps/paperless/paperless-ai.yaml",
+                  r"client_id=(?:paperless-ai-agent|\d+)", "client_id={value}"),
 }
 
 # Secrets that a live workload mounts but no SOPS file in git defines. The phase
 # cannot re-point them safely, so it names them.
-MANUAL_ONLY = {
-    "homarr": "Secret homarr-oidc (keys client-id, client-secret) has no SOPS file in git — "
-              "adopt it first, then add it to SECRET_MAP. The repo also carries an orphan "
-              "homarr-auth-oidc.enc.yaml that nothing consumes.",
-}
+MANUAL_ONLY: dict[str, str] = {}
 
 
 def state_outputs() -> dict: